CVE-2026-23929
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Prototype pollution vulnerability in searchParamsToObject() leads to persistent XSS in Maps. URL parameter processing did not filter dangerous properties like __proto__, combined with jQuery's unsafe element creation that traversed the prototype chain.
Risk Assessment
An attacker can inject malicious script that executes in viewers' sessions, potentially leading to data theft or session hijacking.
Recommendation
Update the component to a patched version and ensure URL parameters are properly sanitized.
Original NVD description (English source)
Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__, combined with jQuery's unsafe element creation that traversed the prototype chain.